Disruption is a defensive action that reduces an attacker’s ability to communicate, coordinate, or operate. In cyber security, it usually targets the attacker’s infrastructure rather than the malware code itself. That can include domains, servers, redirectors, command-and-control channels, or peer coordination systems.
Disruption matters because it can cut off an intrusion before full cleanup is possible. A botnet may still exist on infected devices, but if defenders seize or sinkhole its control plane, the operator loses reach and the malware becomes harder to task, update, or monetize. In real defenses, disruption is often paired with telemetry, victim identification, and remediation, because blocking communications does not automatically remove persistence or stop reinfection. In attacks, the opposite goal is also common: attackers design resilient networks to resist disruption by using redundancy, peer-to-peer links, or fast-changing infrastructure.